Attacks on airlines, logistics providers, and shipping companies, where spoofed invoices and delivery pretexts are common lures. Each entry is broken down with an original video explainer, key findings, and the red flags your team should watch for. How we produce these.
Russia-aligned Gorbag has targeted Ukrainian government, justice, defense, and logistics organizations with convincing spearphishing emails. The group used a compromised local-government email account to send a fake administrative-fines notice with a malicious Excel attachment, then shifted to…
Russia-aligned group Gorbag targeted Ukrainian public-sector and defense organizations with spearphishing emails disguised as administrative fines and tax matters. The messages delivered malicious files that stole browser passwords, VPN settings, documents, and electronic-signature keys,…
Google says attackers are using fake application portals to trick LLM users into handing over active access tokens, allowing criminals to use expensive AI services on the victim’s account. In a separate campaign, unauthorized AI-tool resellers instructed employees to run a one-line setup command…
Russia-aligned group Gorbag targeted Ukrainian government, justice, defense, and transport organizations with spearphishing emails disguised as routine administrative fines and tax notices. The group used compromised government email accounts and weaponized attachments to steal browser passwords,…
Russia-aligned group Gorbag targeted Ukrainian government, justice, defense, and military-aid transport organizations with phishing emails carrying malicious attachments. The emails were disguised as official administrative fine or tax documents, and opening them enabled theft of passwords, VPN…
Researchers found that criminals are stealing cloud and AI access, then reselling it through illicit AI services while victims receive enormous cloud bills. In one documented case, a group used a fake portal for LLM users to trick visitors into submitting information containing active access…
Mandiant investigated real 2026 incidents in which criminals stole or abused cloud and LLM access to run up massive unauthorized charges. In one case, UNC6993 used a fake application portal to persuade LLM users to paste active access-token data, allowing the attackers to bypass password and MFA…
Google’s threat researchers investigated real attacks in which criminals stole cloud and AI-service access, then ran up charges exceeding $100,000 in a day and, in one case, nearly $1 million. One group used a fake LLM user sign-up portal to trick visitors into providing active access tokens, while…
Iran-aligned DarkBlinders used convincing recruitment offers while posing as Dubai Airports recruiters to target a high-value job seeker in Iraq. The victim was asked to complete what appeared to be a coding assessment, but the assessment package installed malware. The group also used lookalike…
A gray-market service persuaded employees to install genuine OpenAI Codex and Anthropic Claude Code tools, then run a follow-up setup command that redirected the tools through relay servers it controlled. The configuration changes could expose every prompt, file, and login token sent through the…
Retailers face a peak-season gift-card fraud campaign in which attackers use phishing emails and text messages to trick employees into giving up credentials. After gaining access, the attackers use cloud systems and sensitive data to issue unauthorized gift cards at scale and convert them into…
Attackers sent Korean-language emails posing as FedEx tax invoices to pressure billing and payment staff into opening a ZIP attachment. The attachment contains a blank-looking PDF that asks the recipient to approve a security prompt, allowing hidden commands to launch malware on Windows.
A Russia-linked operation used a spear-phishing email with a malicious attachment to gain access to a Ukrainian logistics company. UAC-0099 established access and later handed the victim environment to Sandworm, which carried out a destructive data-wiping attack more than two months later.
A Ukraine-based grain logistics company was breached through a spearphishing email carrying a malicious attachment. UAC-0099 used the access to install backdoors, then handed access to Sandworm, which later deployed a data-wiping attack. The initial email attachment is a realistic…
Russian-linked group UAC-0099 reportedly used a phishing email with a malicious attachment to enter the network of an unnamed Ukrainian grain logistics company. Researchers believe the group then handed access to Sandworm, which carried out a data-wiping attack two months later, disrupting the…
Microsoft and partners disrupted three "phishing-as-a-service" kits that enabled criminals to send more than a billion phishing emails and SMS messages worldwide. The kits provided ready-made fake brand pages (government, finance, logistics, consumer brands) designed to steal login credentials and…
Researchers uncovered a commercial phishing-kit-as-a-service called “Iron Man System” that lets criminals quickly deploy fake brand pages (postal/courier, toll fines, tax, banks, telecoms, loyalty programs) to steal victim data. The operation appears active and professionally maintained, with…
Microsoft and Health-ISAC disrupted a Chinese-language phishing marketplace ecosystem (YAM Store, CoGUI, and Iron Man) that enabled criminals to send over a billion malicious messages globally. The services sold phishing kits, compromised accounts, and infrastructure, and were frequently used to…
Microsoft and partners disrupted a Chinese-language phishing kit ecosystem (tracked as Storm-2990) used to send over 1 billion malicious email and SMS messages to more than 75,000 organizations worldwide. The kits used common “urgent alert” scams (delivery issues, unpaid tolls, bank or tax…
Researchers linked an Iran-aligned campaign to recruitment-themed social engineering that tricked a targeted Iraqi software engineer into downloading a fake "Dubai Airports" careers portal and then opening a trojanized Visual Studio coding test. The lure abused normal developer workflows so malware…
Mirage simulates attacks like these against your own team, live and safely, so you can measure how your people actually respond.
